setup: integrate reusable runner setup and Azure VMSS bootstrap

.github/actions/check-quality/action.yml

@@ -43,7 +43,12 @@ runs:
           scripts/setup/setup-linux-mshv.sh \
           scripts/setup/setup-linux-runner.sh
         ${SHELLCHECK} --shell=bash \
-          .github/specula/setup-runner.sh guest/ubuntu/nvx-bashrc
+          .github/specula/setup-runner.sh guest/ubuntu/nvx-bashrc \
+          scripts/setup/azure/linux/bootstrap-runner.sh \
+          scripts/setup/azure/linux/block-runner-metadata.sh \
+          scripts/setup/azure/linux/setup-data-disk.sh \
+          scripts/setup/azure/linux/setup-mshv.sh \
+          scripts/setup/azure/linux/verify-mshv.sh
         python -m pyright --pythonplatform Linux
         python -m pyright --pythonplatform Windows
         python -m ruff format --check scripts .github/specula
@@ -59,7 +64,12 @@ runs:
           scripts/setup/setup-linux-mshv.sh \
           scripts/setup/setup-linux-runner.sh
         ${SHFMT} -d -ln bash -i 4 -ci \
-          .github/specula/setup-runner.sh guest/ubuntu/nvx-bashrc
+          .github/specula/setup-runner.sh guest/ubuntu/nvx-bashrc \
+          scripts/setup/azure/linux/bootstrap-runner.sh \
+          scripts/setup/azure/linux/block-runner-metadata.sh \
+          scripts/setup/azure/linux/setup-data-disk.sh \
+          scripts/setup/azure/linux/setup-mshv.sh \
+          scripts/setup/azure/linux/verify-mshv.sh
 
     - name: Check Markdown links
       shell: bash
@@ -75,14 +85,22 @@ runs:
       run: |
         $tokens = $null
         $errors = $null
-        [void][System.Management.Automation.Language.Parser]::ParseFile(
-          (Resolve-Path "scripts/setup/setup-windows-whp.ps1"),
-          [ref]$tokens,
-          [ref]$errors
-        )
-        foreach ($error in $errors) {
-          Write-Error $error -ErrorAction Continue
-        }
-        if ($errors.Count -ne 0) {
-          exit 1
+        foreach ($path in @(
+          "scripts/setup/setup-windows-whp.ps1",
+          "scripts/setup/azure/windows/bootstrap-runner.ps1",
+          "scripts/setup/azure/windows/install-package.ps1",
+          "scripts/setup/azure/windows/setup-data-disk.ps1",
+          "scripts/setup/azure/windows/vmss-bootstrap.ps1"
+        )) {
+          $tokens = $null
+          $errors = $null
+          [void][System.Management.Automation.Language.Parser]::ParseFile(
+            (Resolve-Path $path), [ref]$tokens, [ref]$errors
+          )
+          foreach ($error in $errors) {
+            Write-Error "$path : $error" -ErrorAction Continue
+          }
+          if ($errors.Count -ne 0) {
+            exit 1
+          }
         }

.github/actions/validate-nvx/action.yml

@@ -9,8 +9,9 @@ runs:
       shell: bash
       run: |
         set -euo pipefail
+        python3 -m pip install --requirement scripts/setup/azure/requirements.txt
         python3 -m compileall -q scripts
-        python3 -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_guest_binaries.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_host_telemetry.py scripts/test_time_abi.py scripts/test_tool_versions.py scripts/test_markdown_links.py -v
+        python3 -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_guest_binaries.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_host_telemetry.py scripts/test_time_abi.py scripts/test_tool_versions.py scripts/test_markdown_links.py scripts/test_setup_azure.py -v
         python3 scripts/test_adversarial.py -v
         python3 .github/skills/nvx-host-connect/scripts/test_hosts.py -v
         python3 scripts/nvx.py --help
@@ -28,9 +29,11 @@ runs:
       shell: powershell
       run: |
         $ErrorActionPreference = "Stop"
+        python -m pip install --requirement scripts/setup/azure/requirements.txt
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
         python -m compileall -q scripts
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-        python -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_guest_binaries.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_host_telemetry.py scripts/test_time_abi.py scripts/test_tool_versions.py scripts/test_markdown_links.py -v
+        python -m unittest scripts/test_performance.py scripts/test_nvx_tools.py scripts/test_guest_binaries.py scripts/test_microvm_tests.py scripts/test_development_release.py scripts/test_host_telemetry.py scripts/test_time_abi.py scripts/test_tool_versions.py scripts/test_markdown_links.py scripts/test_setup_azure.py -v
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
         python scripts\test_adversarial.py -v
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

nvx-rs/tests/cli.rs

@@ -121,6 +121,10 @@ impl Root {
             let path = self.below(entry["path"].as_str().unwrap());
             if entry.get("openvmm").is_some() {
                 fs::create_dir_all(path.parent().unwrap()).unwrap();
+                // Concurrent forks must not inherit a writable fixture executable.
+                #[cfg(unix)]
+                std::os::unix::fs::symlink(FAKE_OPENVMM, &path).unwrap();
+                #[cfg(windows)]
                 fs::copy(FAKE_OPENVMM, &path).unwrap();
             } else if let Some(text) = entry.get("text") {
                 fs::create_dir_all(path.parent().unwrap()).unwrap();
@@ -459,6 +463,14 @@ fn populated_root() -> Root {
     root
 }
 
+#[cfg(unix)]
+#[test]
+fn fixture_roots_link_the_built_executable() {
+    let root = populated_root();
+    let executable = root.below("openvmm/target/release/openvmm");
+    assert_eq!(fs::read_link(executable).unwrap(), Path::new(FAKE_OPENVMM));
+}
+
 fn run(root: &Root, arguments: &[String]) -> Output {
     nvx_rs(root, arguments, &BTreeMap::new())
 }

requirements-dev.txt

@@ -1,2 +1,3 @@
 pyright[nodejs]==1.1.411
 ruff==0.15.22
+-r scripts/setup/azure/requirements.txt

scripts/setup/README.md

@@ -6,6 +6,9 @@ These scripts prepare an existing NVX checkout on a supported host:
 - `setup-windows-whp.ps1` configures Windows/WHP build prerequisites.
 - `setup-linux-runner.sh` configures a Linux/KVM or Linux/MSHV Actions runner.
 
+For Azure VMSS bootstrapping, see [Azure provisioning](azure/README.md). The
+scripts in this directory remain usable on supported hosts outside Azure.
+
 They do not create machines or initialize a checkout. The runner modes consume
 a short-lived registration token from standard input and do not store repository
 credentials in the scripts. Initialize the OpenVMM submodule before using the
@@ -37,15 +40,21 @@ $token = gh api --method POST `
   repos/microsoft/nvx/actions/runners/registration-token --jq .token
 $token | ssh HOST powershell.exe -NoProfile -ExecutionPolicy Bypass `
   -File C:\setup-windows-whp.ps1 -RunnerOnly `
-  -RunnerName azure-windows-3 -RunnerTokenStdin
+  -RunnerName nvx-windows-3 -RunnerTokenStdin
 $token = $null
 ```
 
 Both scripts verify the Actions runner package against the manifest's
 checksum. Linux runner labels are `linux`, the selected backend, and
 `virtual-machine`. Windows labels are
 `windows`, `whp`, and `virtual-machine`. Runner names remain unique identities
-but are not registered as labels. `--benchmark-runner` on Linux and
+but are not registered as labels. Use `--extra-runner-labels LABELS` on Linux
+or `-ExtraRunnerLabels LABELS` on Windows to add comma-separated pool labels
+without removing these required labels. Labels may contain letters, digits,
+underscores, periods, and hyphens, and must not duplicate another label
+(case-insensitively). Changing a configured runner's labels requires a fresh
+registration token; check mode requires the same additional labels.
+`--benchmark-runner` on Linux and
 `-BenchmarkRunner` on Windows also register the `benchmark` label, which CI's
 platform jobs require. Exactly one runner of each backend's pool carries it, so
 that every run measures the backend's performance series on the same VM, and
@@ -65,6 +74,9 @@ that runner's host matches.
 On Linux, omit `--runner-name` to prepare host dependencies without reconciling
 an existing runner's service or cache directory. Pass its name in a subsequent
 invocation to update the service; `--check-only` still validates runner state.
+On Windows, an initial `-RunnerOnly` pass may create `_work` for sccache before
+registration; a subsequent named pass accepts that directory but refuses
+unrelated partial runner installations.
 Rustup bootstrap binaries are versioned and SHA-256 verified before execution;
 Linux provisioning also installs `zstd` for native Actions cache archives.
 Both runner setup scripts install a pinned, SHA-256-verified `sccache` binary.
@@ -102,7 +114,7 @@ workflow jobs run as the dedicated `nvx-runner` account, which has neither sudo
 nor Docker access.
 Linux provisioning and check mode warn, but don't stop, when the host CPU
 doesn't expose an invariant TSC (`nonstop_tsc` in `/proc/cpuinfo`). The flag
-is evidence only. Before the time ABI, guests on such an Azure VM hit
+is evidence only. Before the time ABI, guests on such hosts hit
 cross-vCPU TSC warps during CPU activation (#265); under it, the guest warp
 probe (H6) checks their skew against the ABI's 1 µs bound, so qualify such a
 VM with `python3 scripts/nvx.py doctor --backend <backend>` before
@@ -120,7 +132,7 @@ sh scripts/setup/setup-linux-runner.sh \
 
 ```powershell
 .\scripts\setup\setup-windows-whp.ps1 `
-  -RunnerOnly -RunnerName azure-windows-3 -CheckOnly
+  -RunnerOnly -RunnerName nvx-windows-3 -CheckOnly
 ```
 
 ### Rust toolchain
@@ -147,7 +159,7 @@ scp scripts/setup/setup-windows-whp.ps1 scripts/setup/tool-versions.conf HOST:C:
 ssh HOST powershell.exe -NoProfile -ExecutionPolicy Bypass `
   -File C:\setup-windows-whp.ps1 -RunnerOnly
 ssh HOST powershell.exe -NoProfile -ExecutionPolicy Bypass `
-  -File C:\setup-windows-whp.ps1 -RunnerOnly -RunnerName azure-windows-3 -CheckOnly
+  -File C:\setup-windows-whp.ps1 -RunnerOnly -RunnerName nvx-windows-3 -CheckOnly
 ```
 
 ## Linux / MSHV